On Tue, Aug 29, 2023 at 06:42:46PM +1000, Matthew J Black via Postfix-users
wrote:
> ~~~
> postmap: warning: connect to mysql server sql.my_example.com: Access denied
> for user 'mail-user'@'192.168.1.101' (using password: YES)
> postmap: fatal: table mysql:/etc/postfix/sql_vdomains.cf: query error:
> Resource temporarily unavailable
> ~~~
>
> As I said, the only change being made is turning on TLS on the DB Server ie
> in /etc/my.cnf.d/my_settings.cnf add the settings:
> ~~~
> require_secure_transport=ON
> ssl-ca=/my/cert/path/ca_bundle.pem
> ssl-cert=/my/cert/path/sql.my_example.com_rsa.crt
> ssl-key=/my/cert/path/sql.my_example.com_rsa.key
> ~~~
The docs are at:
https://mariadb.com/kb/en/securing-connections-for-client-and-server/
Are the configuration changes you quote server-specific, or are they
also in scope for client connections (i.e. the client also ends up with
a TLS key and cert)? See spefically:
https://mariadb.com/kb/en/securing-connections-for-client-and-server/#enabling-two-way-tls-for-mariadb-clients
where they mention:
Two-way SSL is required for an account if the REQUIRE X509, REQUIRE
SUBJECT, and/or REQUIRE ISSUER clauses are specified for the
account.
Depending on how things are configured, presenting client certs might be
required, or could be the source of the problem (might change the
server's notion of the client's identity). See also:
https://mariadb.com/kb/en/securing-connections-for-client-and-server/#requiring-tls
It is also possible that the Postfix MySQL client isn't even attempting
TLS, because you haven't configured any the TLS settings that tell
Postfix you want to use TLS:
tls_cert_file
File containing client's X509 certificate.
This parameter is available with Postfix 2.11 and later.
tls_key_file
File containing the private key corresponding to tls_cert_file.
This parameter is available with Postfix 2.11 and later.
tls_CAfile
File containing certificates for all of the X509 Certification
Authorities the client will recognize. Takes precedence over
tls_CApath.
This parameter is available with Postfix 2.11 and later.
tls_CApath
Directory containing X509 Certification Authority certificates
in separate individual files.
This parameter is available with Postfix 2.11 and later.
You might need at least one of tls_CAfile or tls_CApath to be non-empty.
--
Viktor.
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
